What is the CVSS score of EUVD-2026-42389?

EUVD-2026-42389 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.5%.

Which versions of NATS Server are affected by EUVD-2026-42389?

NATS Server contains a high-severity denial-of-service vulnerability affecting HTTP monitoring endpoints (/connz and /subsz) that allows any network-accessible client to crash the entire message…. A patch is available.

How to fix or mitigate EUVD-2026-42389?

Within 24 hours: Identify all NATS Server deployments and document their versions using 'nats-server -v'; assess which networks and clients can reach the /connz and /subsz HTTP monitoring endpoints. Within 7 days: Restrict network access to monitoring endpoints to administrative networks only via firewall or load balancer rules; implement input validation on pagination parameters or deploy WAF rules rejecting excessive offset/limit values. Within 30 days: Monitor nats-io/nats-server GitHub repository and CISA advisories for patch availability; develop and test upgrade plan in non-production environment; schedule production deployment upon patch release.

NATS Server EUVD-2026-42389

| CVE-2026-58207 MEDIUM

Integer Overflow or Wraparound (CWE-190)

2026-07-06 vendor:ubuntu

Information Disclosure Integer Overflow Red Hat Nats Server Linuxfoundation

6.5

CVSS 3.1 · NVD

Severity by source

Vendor (vendor:ubuntu) PRIMARY

HIGH

qualitative

NVD

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-reachable low-complexity overflow crashing the broker gives A:H with no C/I; PR:L reflects access to the monitoring interface, and the panic stays within one security authority so S:U.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (vendor:ubuntu).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Severity Changed

Jul 09, 2026 - 19:22 NVD

HIGH MEDIUM

CVSS changed

Jul 09, 2026 - 19:22 NVD

7.7 (HIGH) 6.5 (MEDIUM)

Patch available

Jul 08, 2026 - 22:04 EUVD

Analysis Updated

Jul 08, 2026 - 21:30 vuln.today

v3 (cvss_changed)

Source Code Evidence Fetched

Jul 08, 2026 - 21:30 vuln.today

Analysis Updated

Jul 08, 2026 - 21:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 08, 2026 - 21:22 vuln.today

cvss_changed

CVSS changed

Jul 08, 2026 - 21:22 NVD

7.7 (HIGH)

Analysis Generated

Jul 06, 2026 - 20:21 vuln.today

DescriptionNVD

[Unknown description]

AnalysisAI

Denial of service in NATS Server (nats-io/nats-server) affects the HTTP monitoring endpoints /connz and /subsz, where attacker-controlled offset and limit pagination parameters trigger a signed integer overflow (Offset+Limit wrapping from math.MaxInt64 to math.MinInt64), producing invalid slice bounds and a server panic. Any client able to reach the monitoring interface can crash the broker, disrupting all connected messaging clients. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; the upstream fix clamps offsets using min/max bounds.

Technical ContextAI

NATS Server is a high-performance, CNCF-hosted messaging system written in Go that exposes an optional HTTP monitoring interface. The flaw is a CWE-190 Integer Overflow in server/monitor.go inside the Connz() and Subsz() pagination logic: the code computed maxoff := Offset + Limit before bounds-checking, so with Offset near math.MaxInt64 the addition overflows into a negative value (math.MinInt64). The negative/out-of-range result then feeds slice indexing over the client/subscription arrays, causing a runtime panic. The patched code replaces the naive addition with saturating arithmetic (minoff := min(max(Offset,0), maxIndex); maxoff := minoff + min(Limit, maxIndex-minoff)), which is confirmed by the fix commits and the added regression tests TestMonitorConnzOffsetOverflow and TestMonitorSubszOffsetOverflow.

RemediationAI

Upgrade to a fixed release: Vendor-released patch v2.12.12 (2.12.x line) or v2.14.3 (2.14.x line), available at https://github.com/nats-io/nats-server/releases/tag/v2.12.12 and https://github.com/nats-io/nats-server/releases/tag/v2.14.3; review GHSA-q59r-vq66-pxc2 for the full advisory. If immediate patching is not possible, restrict or disable the HTTP monitoring interface: bind the monitoring port (default 8222 HTTP / 8443 HTTPS) to localhost only, place it behind a firewall or reverse proxy that rejects unauthenticated access, and block external reachability to /connz and /subsz - the trade-off is loss of remote observability and any dashboards or scrapers that poll those endpoints. Where monitoring must stay enabled, front it with a proxy that validates/clamps the offset and limit query parameters to sane ranges.